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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1 . (Currently Amended) A computer program product comprising a computer 
program operable to control a computer to detect a malicious alteration to a stored computer file, 
said computer program comprising: 

file comparing logic operable to directly compare the entire contents of said 
stored computer file with the entire contents of an archive copy of said computer file as stored 
when said stored computer file was created; and 

comparison response logic operable if said file comparing logic detects that the 
entire contents of said stored computer file and the entire contents of said archive computer file 
do not match to trigger further countermeasures against a potential malicious alteration. 

2. (Original) A computer program product as claimed in claim 1, wherein said 
further countermeasures include scanning said stored computer file using a library of computer 
virus definition data to identify a computer virus infection of said stored computer file. 

3. (Original) A computer program product as claimed in claim 1, wherein said 
archive copy of said computer file is stored in one of: 

an unencrypted form; 
an encrypted form; 
an encrypted media; 
an encrypted volume; and 
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a PGP disk. 

4. (Original) A computer program product as claimed in claim 1, wherein said 
archive copy of said computer file is stored in one of: 

a different physical storage device to said stored computer file; and 

a different part of a common physical storage device shared with stored computer 

file. 

5. (Original) A computer program product as claimed in claim 1, wherein a subset of 
file types stored by said computer are subject comparison by said file comparing logic and to 
creation of an archive copy for use with said file comparing logic. 

6. (Original) A computer program product as claimed in claim 5, wherein said 
subset of file types include one or more of: 

executable file types; and 
dynamic link library file types. 

7. (Currently Amended) A computer program product as claimed in claim 1, 
comprising archive file copy logic operable upon creation of said stored computer file to also 
cr e at e d create said archive copy of said computer file. 
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8. (Original) A computer program product as claimed in claim 7, wherein said 
archive file copy logic operates to create said archive copy of said computer file for a subset of 
file types stored by said computer. 

9. (Currently Amended) A computer program product as claimed in claim 8, 
wherein said subset of file types include includes one or more of: 

executable file types; and 
dynamic link library file types. 

10. (Currently Amended) A method of detecting a malicious alteration to a stored 
computer file, said method comprising the steps of: 

directly comparing the entire contents of said stored computer file with the entire 
contents of an archive copy of said computer file as stored when said stored computer file was 
created; and 

if said file comparing step detects that the entire contents of said stored computer 
file and the entire contents of said archive computer file do not match, triggering further 
countermeasures against a potential malicious alteration. 

11. (Original) A method as claimed in claim 10, wherein said further countermeasures 
include scanning said stored computer file using a library of computer virus definition data to 
identify a computer virus infection of said stored computer file. 
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12. (Original) A method as claimed in claim 10, wherein said archive copy of said 
computer file is stored in one of: 

an unencrypted form; 
an encrypted form; 
an encrypted media; 
an encrypted volume; and 
a PGP disk. 



13. (Original) A method as claimed in claim 10, wherein said archive copy of said 
computer file is stored in one of: 

a different physical storage device to said stored computer file; and 

a different part of a common physical storage device shared with stored computer 

file. 



14. (Original) A method as claimed in claim 10, wherein a subset of file types stored 
by said computer are subject comparison by said file comparing logic and to creation of an 
archive copy for use in said comparing step. 



15. (Original) A method as claimed in claim 14, wherein said subset of file types 
include one or more of: 

executable file types; and 
dynamic link library file types. 
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16. (Original) A method as claimed in claim 10, comprising the step of upon creation 
of said stored computer file also creating said archive copy of said computer file. 

17. (Original) A method as claimed in claim 16, wherein said step of creating said 
archive copy operates to create said archive copy of said computer file for a subset of file types 
stored by said computer. 

18. (Original) A method as claimed in claim 17, wherein said subset of file types 
include one or more of: 

executable file types; and 
dynamic link library file types. 

19. (Currently Amended) Apparatus for processing data operable to detect a 
malicious alteration to a stored computer file, said apparatus comprising: 

a file compart to r comparator operable to directly compare the entire contents of 
said stored computer file with the entire contents of an archive copy of said computer file stored 
when said as stored computer file was created; and 

a comparison responder operable if said file comparing logic detects that the 
entire contents of said stored computer file and the entire contents of said archive computer file 
do not match to trigger further countermeasures against a potential malicious alteration. 
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20. (Original) Apparatus as claimed in claim 19, wherein said further 
countermeasures include scanning said stored computer file using a library of computer virus 
definition data to identify a computer virus infection of said stored computer file. 

21. (Original) Apparatus as claimed in claim 19, wherein said archive copy of said 
computer file is stored in one of: 

an unencrypted form; 
an encrypted form; 
an encrypted media; 
an encrypted volume; and 
a PGP disk. 

22. (Original) Apparatus as claimed in claim 19, wherein said archive copy of said 
computer file is stored in one of: 

a different physical storage device to said stored computer file; and 

a different part of a common physical storage device shared with stored computer 

file. 

23. (Original) Apparatus as claimed in claim 19, wherein a subset of file types stored 
by said computer are subject comparison by said file comparitor and to creation of an archive 
copy for use with said file comparitor. 
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24. (Original) Apparatus as claimed in claim 23, wherein said subset of file types 
include one or more of: 

executable file types; and 
dynamic link library file types. 

25. (Currently Amended) Apparatus as claimed in claim 19, comprising an archive 
file copier operable upon creation of said stored computer file to also created create said archive 
copy of said computer file. 

26. (Original) Apparatus as claimed in claim 25, wherein said archive file copier 
operates to create said archive copy of said computer file for a subset of file types stored by said 
computer. 

27. (Original) Apparatus as claimed in claim 26, wherein said subset of file types 
include one or more of: 

executable file types; and 
dynamic link library file types. 



